NIST SP 800-53, RMF and multi-framework compliance
You apply the seven steps of the NIST Risk Management Framework and the SP 800-53 control families and baselines, and meet ISO/IEC 27001, CIS Controls, SOC 2 and regulatory requirements at once with a common control library.
Level 401 · 16 lessons · 15 practice labs
Lessons
RMF
- The seven steps of the RMF
- Categorising systems: FIPS 199
- Authorisation and authority to operate
- Quick task: categorise three systems
SP 800-53
- Control families and enhancements
- Baselines and tailoring
- The system security plan and POA&M
- OSCAL: machine-readable controls
- Quick task: the access control section of an SSP
Multi-framework compliance
- A common control library
- Crosswalks and their traps
- Test once, comply many times
- Tracking regulatory change
- Quick task: a twenty-control crosswalk
Finish
- Continuous monitoring and ongoing authorisation
- Capstone: a control library that satisfies four frameworks
Practice labs
- Match the RMF step to the activity: Match fourteen activities to the seven steps of the Risk Management Framework.
- Categorise three systems: Set the confidentiality, integrity and availability impact levels and overall category of three systems from their information types.
- Assess an authorisation package: From a system's security plan, assessment report and action plan, recommend granting, conditionally granting or denying authority to operate.
- Place the control in its family: Match twenty control statements to their SP 800-53 control family.
- Tailor the baseline: From the moderate baseline, write with reasons the controls scoped out, added and given parameter values for a cloud-hosted system.
- Select the control enhancements: For five controls, write which enhancements the system's risk calls for and why.
- Find the gaps in the POA&M rows: Mark which of ten plan of action rows lack resources, milestones or a completion date.
- The access control section of an SSP: Write the implementation statement, responsible role and status of six access controls for a payroll system.
- Read and check OSCAL content: In a machine-readable control file, find the parameters of given controls and report inconsistencies with the security plan text.
- Pick the common control candidates: Among thirty requirements, find the groups of similar ones that one control can satisfy.
- A twenty-control crosswalk: Map twenty controls to their SP 800-53, ISO/IEC 27001, CIS Controls and SOC 2 counterparts.
- Catch the traps in a crosswalk: In a prepared crosswalk, find eight rows that count a partial overlap as full and write the requirement left unmet.
- Assign the monitoring frequency: Assign continuous, monthly, quarterly or annual monitoring to fifteen controls by volatility and risk.
- Test once, comply many times: Prepare a table showing which requirements in four frameworks one access review test evidences.
- Track the effect of a regulatory change: From a framework's new-version summary, find the affected common controls and list the changes to make in the library.
About this course
You apply the seven steps of the NIST Risk Management Framework and the SP 800-53 control families and baselines, and meet ISO/IEC 27001, CIS Controls, SOC 2 and regulatory requirements at once with a common control library.
What you will learn
- RMF
- SP 800-53
- Multi-framework compliance
- Finish
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.